Sentiaus commented on PR #5721:
URL: https://github.com/apache/texera/pull/5721#issuecomment-4906481868
@aicam I don't think it's possible for the callback function to process the
entire upload. The user would have to preselect their folder in some way using
the picker, which requires an access token and apikey. The upload would then be
done by requesting a resumable upload from Google on the frontend, and passing
the session URI to the backend, so that uploads can be done entirely from
file-service via the session URI.
Seeing as the session URI is only useful for one pre-configured upload, we
wouldn't have to worry about any other services seeing the token, not even file
service.
The flow could be rewritten however, s.t. the backend never sees the access
token. (Did not initially consider this as I was working backwards from the
refresh_token approach which would require the backend to process the request
to Google.)
```mermaid
sequenceDiagram
participant User
participant OAuth as Google/OAuth
participant DrivePicker as Drive Picker
participant FS as File-service
participant MinIO
User->>OAuth: 1. OAuth Flow
OAuth->>User: 2. Send access token
User->>DrivePicker: 3. Send access token + apiKey
DrivePicker-->>User: 4. Return folder selection
User->>OAuth: 5. Request resumable upload
User->>FS: 6. Send resumable upload URI
FS->>MinIO: 7. Request file
MinIO-->>FS: 8. Return file
FS->>OAuth: 9. Send file
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
